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December 5, 2013 



Mary Mayhew, Commissioner 
Department of Health and Human Services 
1 1 State House Station 
Augusta, ME 04333-0011 

Dear Commissioner Mayhew, 

The Office of the State Auditor conducted a Umited procedures engagement of Department of Health and 
Human Services surveillance of MaineCare expenditures. 

We have completed our report and DHHS personnel have responded to our concerns in writing. Their 
responses have been incorporated into our report and the report is attached to this letter. 

Our report will be available on the Office of the State Auditor website at 
http://www.maine.gov/audit/reports.htm . in the section for Other Reports. 

We thank Director of Audits Herb Downs, Audit Manager Greg Nadeau along with other members of the 
Program Integrity staff, and persons employed by the Department of Administrative and Financial 
Services for their assistance during this engagement. 



State Auditor 

Cc: Honorable Margaret Craven, Senate Chair, Health and Human Services Committee 
Honorable Richard Famsworth, House Chair, Health and Human Services Committee 
Honorable H. Sawin Millett, Commissioner, Department of Administrative and Financial Services 
Beth Ashcroft, Director of OPEGA, Office of Program Evaluation and Government Accountability 
Jim Smith, Commissioner, OIT, Department of Administrative and Financial Services 
William Boeschenstein, Chief Operating Officer, Department of Health and Human Services 
Nick Adolphsen, Director of Legislative Affairs, Department of Health and Human Services 
Sam Adolphsen, Director of Strategic Development, Department of Health and Human Services 
Chase S. Martin, Director of Program Initiatives, Department of Health and Human Services 
Herb Downs, Du-ector of Audit, Department of Health and Human Services 
Timothy C. Lawrence, Internal Audit Manager, Department of Health and Human Services 
Greg Nadeau, Audit Manager, Department of Health and Human Services 




Sincere! 



Enclosure 



www.maine.gov/audit 



State of Maine, Office of tlie State Auditor 
Report on Limited Procedures Engagement 
Program Integrity Unit: J~SURS Utilization as of November 5, 2013 
Report Issued on December 5, 2013 

Summary 

The Office of the State Auditor performed a limited procedures engagement relating to the Program 
Integrity (PI) Unit utilization of J-STJRS' to identify fraud, waste, and abuse. Surveillance of MaineCare^ 
program expenditures is the responsibility of the PI Unit within the Maine Department of Health and 
Human Services (DHHS), Division of Audit. Surveillance is important to ensure that State and federal 
dollars for MaineCare are not being put at risk. 

We found that the PI Unit is not using the federally approved J-SURS surveillance module as intended 
and does not have adequate compensating procedures in place. J-SURS should be used to detect 
anomalies and can focus reviews on specific claims processing codes and issues. Instead, currently, 
unless requested to do so by an outside entity^, new cases are predominantly opened for a general review 
to determine whether a problem area can be identified. This lack of systematic analysis results in a narrow 
field of surveillance activity. Immediately following is a description of the audit procedures performed, 
the results of those procedures, root cause of the issues found, and our conclusions and recommendations. 



Range of Financial Impact 

The volume of MaineCare claims processed each year is extremely high and surveillance of expenditures 
using J~SURS is only nominal in comparison. In 2013, over 30 million claims totaling $2.5 billion were 
paid to providers. Therefore, use of the J-SURS tool is critical to the timely and efficient detection of 
fraud, waste, and abuse. If surveillance activities resulted in a reduction of MaineCare expenditures of 
just half of one percent, the annual savings would be $12.5 million. 

For this reason, CMS* approved and paid most of the cost for the State Medicaid Management 
Information System (MMIS) known as the Maine Integrated Health Management Solution (MIHMS). 
This approval was based on the integration of six functioning core subsystems. One of these six 
subsystems is a Surveillance and Utilization Review Subsystem (SURS), which the U.S. DHHS explicitly 
identifies as including PI utilization of the tool in MMIS, known as J-SURS, We computed the cost of the 
MIHMS system to be about $205 miUion based on the lAPD^ Amendment II dated November 13, 2009; 
with nearly $2 million associated with J-SURS. There have been additional costs negotiated since this 
time, but on that date CMS approved about $163 million of federal financial participation for the design, 
implementation and continued support for MltlMS. 



Background 

The PI Unit conducts some nominal analysis of provider claims to detect utilization patterns or trends that 
may indicate firaud, waste, or abuse. Based on data analysis or referrals or complaints received from other 
State agencies, health care providers or members, the PI Unit may also perform retrospective audits or 
reviews of MaineCare providers and members to validate any allegations of firaud, waste, or abuse. 



' The J-SURS, Fraud and Abuse Detection System acts as the Surveillance and Utilization Review module of the State MMIS. 

^ MaineCare (Medicaid) is a federal and state funded program that pays the expenses for people who are unable to pay some or 

all of their own medical and pharmacy costs. 

^ For example, the U.S. DHHS, Office of Inspector General 

* The Centers for Medicare and Medicaid Services. 

^ Implementation Advanced Planning Document. 
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Procedures 

Our procedures, included: 

a reviewing documented State policy and procedures related to surveillance of MaineCare 
expenditures, 

• reviewing specific aspects of J~SURS functionality that CMS approval of MIHMS was identified 
as contingent upon, including: 

(1) Part 11 of the State Medicaid Manual (SMM), which U.S. DHHS makes available to all 
State Medicaid agencies to administer the Medicaid program. It is the official method by 
which CMS issues mandatory, advisory, and optional policies and procedures to State 
Medicaid agencies. The SMM provides instructions, regulatory citations, and 
information for implementing provisions of Title XIX of the Social Security Act (the 
Act). Instructions are official interpretations of the law and regulations, and, as such, are 
binding on State Medicaid agencies. This authority is recognized in the introductory 
paragraph of State plans. Title XIX is the statutory basis for the Medicaid program and 
the foundation for the regulations and all information in the manual. Medicaid 
regulations are contained in Parts 42 and 45 of the Code of Federal Regulations. 
Citations to these regulations are included in the text of the manual. Chapter 1 1 of the 
SMM pertains to the requirements that allow States to qualify for 75% (or 90%) federal 
financial participation (FTP). These include: 11300 General Requirements, 1 1310 MMIS 
Functional Requirements, 11335 Surveillance and Utilization Review (SUR) Subsystem, 
1 1340 Management and Administration Reporting (MAR) subsystem, and 11350 MARS 
and SURS Reports, 

(2) 42 CFR433 of the Code of Federal Regulations, State Fiscal Administration cites that an 
existing or proposed MMIS must: 1) include or encompass all subsystems or 
functionalities; and 2) conform in concept with each subsystem described within Part 1 1 
of the SMM, 

(3) 42 CFR 433.1 16(g) and 433.1 17 of the Code of Federal Regulations states that the MMIS 
must provide both patient and provider profiles for program management and utilization 
review purposes (that FFP is granted by CMS if the system meets these conditions), 

(4) Title 42 US Code 1396(b)(2) of the Code of Federal Regulations relevant to MMIS 
functionality requirements for SURS, 

(5) MMIS Certification Checklists relevant to the original contract with the fiscal agent for J- 
SURS deliverables, 

(6) CMS Approval of the following State prepared Implementation Advanced Planning 
Document (lAPD) for MIHMS: 

a) lAPD, Amendment I, including Scope Clarification pertaining specifically to J- 
SURS 

b) lAPD, Amendment II 

c) Request for Proposal (RFP) related to the MMIS procurement, effective date of 
September 1,2010 

• reviewing supporting documentation for the most recent additional funding of 3790,000 
authorized on February 9, 2012 for J-SURS, 

• reviewing findings and concerns of CMS in the most recent triennial PI reviews relevant to the 
Mame PI Unit operations, dated August 2012 and July 2009, 

• identifying the J-SURS system access rights assigned to all personnel (power user vs. regular 
user); and work actually performed by PI Unit staff using J-SURS, since the MIHMS 
implementation. The purpose being to acquire an understanding of the extent of J-SURS 
experience, skill and degree of comfort levels among the PI Unit manager and staff members. 
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» obtaining J-SURS user and training manuals maintained by PI Unit personnel; and determining 
the level of Report Generator expertise that PI Unit staff possesses to gain an understanding of the 
challenges experienced by all personnel using J-SURS, and 

• determining whether ongoing PI Unit operations adequately include SURS utilization or other 
surveillance type activities, by: 1) reviewing the J-SURS training provided to PI Unit staff since 
June 2011, 2) creating J-Sample SURS (Report Generator, Advanced Drill Down and Top-N) 
sample reports and queries with a Truven J-SURS trainer and PI Unit staff to assess J-SURS 
capability for extremely large scale data mining and large scale data analysis, and 3) reviewing a 
sample of 80 cases selected to be proportionally representative of the PI Unit work performed 
during the eleven month period ending May 31, 2013 to determine whether their operations 
adequately include surveillance-type activities. 

Conclusions 

We found that improvement in surveillance activities using J-SURS is needed to monitor MaineCai'e 
expenditures. These opportunities relate to key controls over MEHMS system functionality and 
compensating PI controls that are in place to detect traud, waste and abuse. 

Testing results indicated, that: 

(1) J-SURS has three separate tools within the module: Report Generator, Advanced DrillDown and, 
within the past year, Top-N. J-SURS was originally designed (and approved by CMS) with only two 
tools: Advanced DrillDown for quick ad-hoc reviews and Report Generator, which has dynamic 
capabilities that allow for continuous claim review at a broad, narrow, deep or on the surface level. 

Report Generator is the power behind J-SURS. It was designed for continuous large scale data raining 
and exception processing of provider and recipient profile claim databases in aggregate with their peer 
groups. It also allows users to detect payment anomalies by rutming and building upon variations of data 
element groups, including Episodes of Care definitions that identify providers and recipients meeting 
certain sets of (time and trigger event) conditions that may have taken place among MaineCare payments. 

• Pi's position is that it takes all three tools to conduct the data mining/analyses required to meet 
the regulations because each data pull has unique criteria (logic), and that any variation of J- 
SURS tools may be used to meet the objectives of the data pull. Yet, the most valuable of the 
three tools. Report Generator, is not being utilized for the most essential surveillance activities 
(large scale data mining, exception processing and data analysis) on a regular basis, if at all. This 
is problematic because CMS approved the current MMIS (MIHMS) based on fiiU utilization of J- 
SURS to comply with federal regulations, which were intended to help States achieve more 
efficient, effective, and economic administration of the Medicaid program. This was the basis for 
allowing the State to receive increased 90 and 75 percent federal financial participation (FTP) for 
MIHMS. 

• Use of the two other J-SURS tools. Advanced Drilldown and Top-N, in place of Report 
Generator functionality is inadequate for many reasons, including: 

a) neither tool was designed with the dynamic capabilities (pre-programmed/automated 
criteria can be easily changed) that are possible with Report Generator. Instead, query 
sets must be re-created with multiple passes of the data - every time (a process that is 
more prone to error, and results unnecessary and excessive time lags), rather than being 
designed with "automated; set it and forget if or "ad-hoc: easy to edit" features of Report 
Generator. 
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b) cutting and pasting of claim data results irom J-SURS is restricted to 65,000 claims or 
rows of data at a time (J-SURS was never upgraded beyond Excel 2007 capabilities), 
rather than being able to capture all claims for review with Report Generator. This 
severely limits surveillance activities, for many reasons - mostly because it causes the 
focus of their work to become more and more, narrow. 

c) exporting *.csv claim data from J-SURS to another location (ACCESS or EXCEL) for 
review takes too long - we observed, about 32 minutes for 150,000 claim records. 

d) unable to open or edit report query logic prior to running the data 

e) unable to reschedule query logic prior to running the data 

f) use of Top-N is particularly problematic because any and all users (including many 
Truven^ support staff) are only able to run one job at a time in the queue. Since they are 
becoming reliant on Top-N, we observed that this causes alarming delays for PI 
productivity. 

(2) Until June 2012, the PI Unit was able to utilize J-SURS Report Generator features with less 
difficulty because management ensured that adequate time was allowed for one specific staff member to 
perform this level of surveillance on an ongoing basis. This individual actively created and used 
algorithms to analyze claims and payment data on a full-time basis; and analysis was adequately 
sophisticated and iterative. Utilizing specialized software in J-SURS and the Data Warehouse profiler, 
this individual was able to generate queries to follow-up on complaints or referrals, analyzed payment 
patterns, and monitored policy enforcement. They also identified the need for additional reviews based 
on claims processing system limitations and overpayments made without prior medical record review. 
When an algorithm was proven effective, it was added to the schedule of regularly run reports for ongoing 
recovery of overpayments made to providers. 

As of this writing, management stated that the most recently hired PI Unit employee will be responsible 
for becoming proficient enough in J-SURS to replace the surveillance activities performed by the former 
Power User who left the Department for another job. This individual and the other staff members will 
require continued training and time to develop the proficiency needed to use all J-SURS components, 
including Report Generator. Due to the complexities involved in learning to use Report Generator 
properly, this is not a simple objective and cannot be accomplished without management support and 
adequate resources. 

We agree with PI that the learning curve needed for a power user to attain the proper level of proficiency 
for Report Generator is somewhat lengthy and arduous. This was identified as the reason that only one 
staff member was assigned this function within PI, until June 2012. No other personnel with sufficient 
capabilities were successfully assigned as a replacement during SFY2013. 

We believe it is not appropriate: 

• that only one individual in the PI Unit be assigned sole knowledge and responsibility for large 
scale surveillance of MaineCare claims using Report Generator. 

The only requirement for using the J-SURS Report Generator is that individuals be given the 
credentials of a "Power User" rather than a "Regular User". One requirement for J-SURS 
functionality (deliverables) in the MMIS contract was for five open and active Power User 
licenses to be provided to the State for SURS activities - we found seven (and only one was 
planned to be used for this level of surveillance work). 



Tmven is the contractor that provides training and technical support for MIHMS to State personnel. 
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• that only one individual among all seven J-SURS Power Users be assigned sole responsibility for 
such significant surveillance work, for a number of reasons, including: a) difficulty in replacing 
them, b) extensive time lost for highly specialized training, c) sole reliance on one individual 
exclusively for the consistent performance of "mission critical" and highly specialized 
surveillance efforts. 

The individual first assigned these duties by the PI Unit left their employment in June 2012. 
Management was not successful in retaining this individual's replacement, and they also left their 
position during SFY2013. This illustrates the disadvantage of placing sole reliance on a single 
individual for mission critical activities. 



Root Causes 

a) Responsibility for surveillance is concentrated with one person, rather than being dispersed among all 
Power Users or PI Unit staff. 

b) Without adequate personnel dedicated to this function, the PI Unit is not able to comply with 
surveillance requirements included in federal regulations. Related activities include data mining, 
exception reporting and data analysis. 



Recommendations 
We recommend that: 

• the Department take steps to ensure that surveillance activities regularly takes place which 
includes: large scale data mining, exception reporting and data analysis as part of their regular 
routine; and the use of all J-SURS Report Generator functionality to more fully aide in the timely 
detection of fraud, waste, and abuse in the MaineCare program, and that 

• PI Unit management ensures that personnel are dedicated to consistently performing independent 
surveillance work on an ongoing basis. 



Acknowledgement and Thanks 

Since we announced this engagement in the spring of 2013, we have found that the PI Unit has begun to 
implement more independent surveillance activities to comply with federal govenmient requirements. 
However, the other J-SURS tools are not a good substitute for the consistent use of Report Generator for 
the purposes it was intended. 

We were expecting to issue this report well before November 2013. We apologize for the delay. We 
thank Director Herb Downs, Manager Greg Nadeau, and the Program Integrity Unit staff for their 
assistance during this engagement. 



continued on next page. . . 
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Program Integrity Unit Responses to Recommendations 



Recommendation 1 

The Department (PI Unit) is currently taking steps to ensure that surveillance activities consistently 
include extremely large scale data mining, exception reporting and data analysis as part of regular routine 
and using all J-SURS Report Generator (RG) tiinctionality and all J-SURS query tools to more fully aide 
in the timely detection of fraud, waste, and abuse in the MaineCare program. 

PFs expectation has never been that only one J-SURS tool (Report Generator) would/should be used for 
data mining. 

Although the Power User's level of proficiency in RG is better than minimal, the learning curve is lengthy 
and arduous. The Data Team consistently use RG for data pulls while running a parallel run in one of the 
other J-SURS tools with known data to build confidence in skills and the tool. 

In response to the recommendation - To support the use of RG to its full extent. Pi's Data Team efforts to 
date are focused on 

o developing and testing processes to support data mining on a large-scale surveillance level 
o parallel data pulls to test our RG logic skills against TopN and/or EIS 
o and, include these activities which are at various levels of completion: 

o Designing efficient processes to standardize and meet our goals - workflows that 

illustrate continuity, decision points and outcomes — will be used in training new staff 
o Developing or revising Policies and Procedures to support our new standardized 
processes 

o Developing and implementing tools to assist in the training of new users- a map of sorts 
o Developing and implementing standardized templates for algorithm planning, 

documenting and tracking cases 
o Researching, verifying data and developing crosswalks to support our data mining 

activities 

o Identifying opportunities to, with simple changes, render the J-SURS system a little more 

efficient to accommodate the ways in which we use it 
o Developing and implementing a standardized Data Mining Quality Control/Assurance 

Process 

o Attending Truven Power Users training 

o Establishing a regular meeting time with a purpose of brainstorming algorithm concepts, 
assigning data mining activities, data mining reviews and reporting out data mining 
results 

o Establishing a schedule for on-site visits by Truven staff to provide assistance in 

developing more complex algorithms and/or helping us with troubleshooting 
o Developing/Implementing a Data Mining Activities tracking tool 

PI continues to mine the data at the provider service type level in both TopN and duplicating the run iti 
RG to test our RG skills. This large-scale surveillance activity includes a peer-to-peer analysis that 
identifies outlier patterns and activities tliat are suspicious of fraud, waste and abuse (FWA), 
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PI fully expects to have completed the SFY2013 Provider Service Type data surveillance activities by 
June 30, 2014 while simultaneously using the J~SURS tool to trend costs by ServiceType over a three 
year timeframe with a start year of SFY2012. 

The Peer-to-Peer Analysis is the template to be used for similar large-scale surveillance activities using 
RG such as Policy Limitations by Service Type, Prohibited Overlapping Services, Monitoring of Claims 
Post-Policy Change, Provider Overutilization, to name a few. 

Recommendation 2 

PI Management recognizes the risk of dedicating only one staff member to performing independent 
surveillance work on an ongoing basis. PI Management has worked diligently to address this risk and in 
early 2013 defined a Data Team (DT) with explicit goals and objectives which include large-scale FWA 
surveillance. 

In addressing the risk, PI took a few months to develop a plan of action that would eliminate this risk, 
over time, as outlined below: 

• PI has established a PI Data Team in the spring of 2013 
o It initially had 3 members and one manager 

o In July and October, 2 additional team members were added. The 2 new members are 

also new to MaineCare and its data 
o All are Power Users 

• The Goals and Objectives of this newly formed team are to 

o Complete the list of activities as referenced in Response # 1 
o Develop a level of confidence in the data by validating and testing data pulls 
o Testing the JSurs tools to determine which tool (Report Generator, TopN, or EIS) is best 
suited for the type of data pull 

■ Report Generator (RG) is used when complex logic is needed to isolate the 
subject of the review 

o Each team member reports their progress toward these goals on a weekly basis at the DT 
Meetings 

o Prioritize the list of potential algorithms based on risk rating 

o Develop and implement a "group" algo planning process to ensure each member of the 

group is learning RG at the same pace and depth 
o Build an Algorithm Library from which any staff member or the assigned staff member 

can review/analyze the findings (RG data pulls are limited to Power Users only). Some of 

this work is already completed 

■ Peer-to-Peer Data Analysis Based on Provider Type 

• Optometry 

• Dermatology 

• All Practitioners 

■ Miscellaneous Codes Review - in progress 

■ Modifiers Review 

■ Services Paid beyond Policy Limits - T 1 026 
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■ Expenses by Diagnosis Codes 

■ Total Paid Amount by Provider Report 

■ Kyphoplasty 

■ Sections 19 and 40 Overlapping Services Resulting in Overpayments 

■ Paid Amount by Service Type Trending Reports (over 3 years) 

■ Policy Section Reviews 

■ Policy Limitations Reviews 

■ Overlapping Policy/Services Reviews 

■ Policy Changes Reviews 

In conclusion, the members of the PI Data Team are working every day to increase the number of FWA 
Sui-veillance data pulls generated using the JSURS tools while verifying and validating the data-returns to 
ensure the integrity and accuracy of the data. We expect the level of planning, detailed verifications and 
testing will further develop the DT's confidence and skills using the Report Generator. 

Thank you for providing the opportunity to review and respond to the audit findings. 
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